The fine details... Assuming my configuration as described above: Incoming mail is [mime decoded and then] broken into tokens - each token is (lowercased) a-z, 0-9, "-", and "'". Each token must have at least one letter in it. Each token may be at most 20 characters. These tokens are then looked up as described in Paul Graham's paper. If it is spam (> 80% probable), it is put in the spam box. If it is not, it is put in the Inbox. All messages in the Deleted box are parsed the same way, and each token is added to the "good words" file (some db file according to your platform - dmb, gdbm, whatever python decides). Then that mail file is truncated to 0 length. The same thing happens to the messages in the VerifiedSpam mailbox. That's all there is to it... I check my spam box every once in a while to make sure no good messages got dumped, and then I move them all to the VerifiedSpam box to be consumed. Regular email I delete as usual (which my mail program moves to a Deleted box). Eventually I may decide to dump Spam directly to VerifiedSpam without looking at it.